When Microsoft shipped an SMB EDR in 2022, the security industry rolled its eyes. Four years of running it across client fleets later: it detects well, the automated investigation genuinely reduces noise, and it's already in Business Premium.
The gripe is the portal, which still assumes you have a security team's patience. That's partly why clients have us.
Verdict: real EDR at SMB economics. With tuning, a serious baseline.
Reviewed from live fleet experience · published June 2026 · we earn a fair margin on some products we supply; reviews are not sponsored.
